Add-on Pre-scanner Card for Network Traffic Virus Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virus scanning technologies face performance delays due to software-based implementations and have low virus detection capabilities when implemented in hardware, with stream scanning offering faster throughput but at the cost of accuracy and hardware-based implementations being vulnerable to attacks.
Innovation Solution
An add-on pre-scanner card is introduced that can be plugged into a local bus to inspect network traffic, pre-scanning packets for viruses and using a shared memory interface to pass scanned payloads to a back-end complex scanner, allowing for two-level virus scanning to reduce latency and enhance performance while maintaining accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If store-scan-forward scanning is implemented in software, then virus detection accuracy is improved with low false positives and negatives, but processing speed deteriorates resulting in excessive delays
Solution Approach 1:
The virus scanning system is segmented into two distinct components: a hardware-based pre-scanner card for initial rapid filtering and a software-based complex scanner for thorough analysis. This segmentation allows the system to combine the speed advantages of hardware with the accuracy advantages of software, resolving the contradiction between detection accuracy and processing speed.
Solution Approach 2:
The hardware pre-scanner performs preliminary virus detection on incoming network traffic before the software scanner processes the data. By conducting initial scanning in hardware, the system quickly filters out obviously malicious traffic, allowing the software scanner to focus only on suspicious packets, thereby maintaining high accuracy while reducing overall processing time.
2Speed
If stream scanning is implemented in hardware, then processing speed is improved with faster throughput, but virus detection capability deteriorates with lower detection rate and higher false positives and negatives
Solution Approach 1:
The scanning function is divided between hardware pre-scanning for speed and software scanning for accuracy. The hardware component handles rapid initial inspection to maintain high throughput, while the software component performs detailed analysis to ensure high detection accuracy, thus resolving the contradiction between speed and detection capability.
Solution Approach 2:
The hardware pre-scanner acts as an intermediary between the network and the software scanner. It performs initial filtering at high speed and passes only suspicious or uncertain packets to the software scanner for thorough analysis, thereby maintaining both high throughput and high detection accuracy.
3Productivity
If hardware-based stream scanning is used, then performance is improved, but security deteriorates by opening the network to virus attacks through less sophisticated scanning algorithms
Solution Approach 1:
The security scanning function is segmented into hardware-based pre-scanning and software-based complex scanning. The hardware layer provides rapid initial protection, while the software layer implements sophisticated algorithms for comprehensive security analysis, ensuring both high performance and strong security protection.
Solution Approach 2:
The hardware pre-scanner performs preliminary security checks using efficient algorithms to quickly identify and block obvious threats. This preliminary action maintains high scanning performance while the subsequent software scanning provides deeper security analysis, ensuring that no security gaps are created.
Data Source
AI summary
In one embodiment, an add-on pre-scanner card is removably pluggable into a local bus of a computer. The add-on pre-scanner card may be coupled to a computer network to receive network traffic. The add-on pre-scanner card may be configured to extract payloads from received packets and scan the payloads for computer viruses. The add-on pre-scanner card may pass scanned payloads and other data to the computer by way of a shared memory interface. The pre-scanner card may identify each payload as infected with a virus, virus-free, or unknown to allow the computer to distinguish payloads that do not need further scanning from those that do. The computer may further scan for viruses payloads that the pre-scanner card cannot ascertain as either virus free or virus infected.